CVE-2026-74801 SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe

SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trigger the Microsoft Defender exclusion...

BIT-JAVA-2026-62574

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Install. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Orac...

BIT-JAVA-2026-60526

Vulnerability in Oracle Java SE component: Installation. Supported versions that are affected are Oracle Java SE: 8u491 and 8u491-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE...

BIT-DOTNET-SDK-2026-62909 .NET Elevation of Privilege Vulnerability

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-67961

The software O2OA v.10.0.2 contains a vulnerability that allows a local attacker to perform arbitrary code execution . The root cause is linked to a flaw in the sandbox mechanism used during the execution of the Invoke script . While the technical impact is high, the documents do not provide spec...

PT-2026-73263

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally...

PT-2026-73273

Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally...

Unity Linux 20.1070e Security Update: GraphicsMagick (UTSA-2026-099444)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099444 advisory. Unity Link Advisory UTSA-2026-099444 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

Unity Linux 20.1070e Security Update: ntfs-3g (UTSA-2026-099504)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099504 advisory. Unity Link Advisory UTSA-2026-099504 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

Unity Linux 20.1070e Security Update: NetworkManager (UTSA-2026-099514)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099514 advisory. A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer...

PT-2026-73365

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Install. Supported versions that are affected are Oracle Java SE: 8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Orac...

CVE-2026-9771: Untrusted Pointer Dereference

The flashcopy system call is verified by zvrfyflashcopy in drivers/flash/flashutil.c. On builds with CONFIGUSERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer KSYSCALLMEMORYWRITE and passed the two struct...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100576)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100576 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2CSMBUSI2CBLOCKDATA case in stubxf...

Unity Linux 20.1070e Security Update: ntfs-3g (UTSA-2026-099472)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099472 advisory. Unity Link Advisory UTSA-2026-099472 Tenable has extracted the preceding description block directly from the Unity Linux security advisory. Note that Nessus has not...

.NET: .NET Elevation of Privilege Vulnerability

Uncaught exception in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

Fedora 44 : stunnel (2026-67c2201ad8)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-67c2201ad8 advisory. Security bugfixes - CVE-2026-70368: Fixed an out-of-bounds memory access triggered by logging attacker-controlled protocol messages longer than 1,02...

Security Bulletin: This Power System update is being released to address CVE-2026-4937

Summary PowerVM could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested. Vulnerability Details CVEID:CVE-2026-4937 DESCRIPTION: PowerVM could allow a local attacker with administrative privileges t...

CVE-2026-72232

In the Linux kernel, the following vulnerability has been resolved: batman-adv: ensure minimal ethernet header on TX As documented in commit 8bd67ebb50c0 "net: bridge: xmit: make sure we have at least eth header len bytes", it is possible by for a local user with eBPF TC hook access to attach a t...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...